Immutable + Offsite Backups on a Budget: restic + rclone, So Ransomware Can't Delete Its Own Insurance
Your compromised host keeps its backup credentials but can't delete or rewrite history, because the repo only accepts appends from a second key. A $5 VPS, one restricted SSH key, and restic 0.19.x — ~2 hours for first setup.